Commit c776371d484425100c43a2c5284e1d2e6c7d3472
Committed by
Gitee
Gitee
1 parent
d97ba8d4
【修复】修复会员取消退款接口中未校验用户ID的漏洞
Signed-off-by: 杨宇庆 <hiyyq@qq.com>
Showing
1 changed file
with
1 additions
and
1 deletions
yudao-module-mall/yudao-module-trade-biz/src/main/java/cn/iocoder/yudao/module/trade/service/aftersale/AfterSaleServiceImpl.java
| @@ -399,7 +399,7 @@ public class AfterSaleServiceImpl implements AfterSaleService { | @@ -399,7 +399,7 @@ public class AfterSaleServiceImpl implements AfterSaleService { | ||
| 399 | @AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_CANCEL) | 399 | @AfterSaleLog(operateType = AfterSaleOperateTypeEnum.MEMBER_CANCEL) |
| 400 | public void cancelAfterSale(Long userId, Long id) { | 400 | public void cancelAfterSale(Long userId, Long id) { |
| 401 | // 校验售后单的状态，并状态待退款 | 401 | // 校验售后单的状态，并状态待退款 |
| 402 | - AfterSaleDO afterSale = tradeAfterSaleMapper.selectById(id); | 402 | + AfterSaleDO afterSale = tradeAfterSaleMapper.selectByIdAndUserId(id, userId); |
| 403 | if (afterSale == null) { | 403 | if (afterSale == null) { |
| 404 | throw exception(AFTER_SALE_NOT_FOUND); | 404 | throw exception(AFTER_SALE_NOT_FOUND); |
| 405 | } | 405 | } |